test(security): regression suite for input validation fixes (#685 #686 #687 #688)
30 test cases covering all four security fixes from PR #701:
#686 — AdminAuth gate on GET /templates and GET /org/templates:
- NoAuth returns 401 when tokens are enrolled
- FreshInstall fails open (bootstraps correctly)
#687 — UUID path param validation:
- URL-encoded traversal (..%2f..%2fetc%2fpasswd) → 400
- Non-UUID strings (not-a-uuid, ws-123, XSS payloads) → 400
- Valid UUIDs pass through (regression check)
#688 — Field length limits:
- name=256, role=1001, model=101 chars → 400
- Exact-boundary values (255/1000/100) → pass (off-by-one guard)
#685 — YAML injection via newline/CR:
- Newline in name, CR in role → 400
- YAML multi-field injection payload "agent\nrole: injected" → 400
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
5dbac3a5ee